Pixshop CLI — AI Image & Video Generation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Pixshop CLI helper, but it deserves Review because it tells users to install a mutable global third-party CLI and use it with OAuth and remote media processing.

Install only if you trust the Pixshop npm package and service. Prefer a pinned or project-local install, avoid elevated privileges, review where credentials are stored, and do not submit private, regulated, or proprietary images, videos, or prompts unless you are authorized to send them to Pixshop.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation of a Third-Party Executable Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-20
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

bash

# 安装
npm install -g pixshop

# 登录（浏览器 OAuth）
pixshop login

Technical Analysis

The Skill directs users or agents to install the latest available pixshop npm package globally without specifying a reviewed version, lockfile, or integrity hash. A global npm installation can execute package lifecycle scripts during installation and place executable code on the user's PATH.

Because the package implementation is not included in this project, its installation behavior, lifecycle scripts, transitive dependencies, and subsequent handling of authentication credentials and media cannot be verified by this audit. The effective code may also change whenever the package publisher releases a new version, even though the reviewed SKILL.md remains unchanged.

This constitutes an insecure dependency and supply-chain risk. The finding does not establish that the current npm package is malicious; it identifies the unsafe, mutable installation mechanism documented by the Skill.

Attack Path

1. An attacker compromises the package publisher, npm account, release pipeline, or a transitive dependency.
2. The attacker publishes a malicious or compromised version under the package name used by the documented command.
3. A user or agent follows the Skill and runs npm install -g pixshop, which resolves to the latest mutable release.
4. npm installs the package globally and may execute attacker-controlled lifecycle scripts.
5. The installed executable subsequently runs through commands such as pixshop login, potentially exposing OAuth session data, local files submitted for processing, or other user-accessible resources.

Impact Assessment

Malicious installation scripts or CLI code could execute with the privileges of the user perform ...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specifically reviewed version, for example pixshop@<reviewed-version>, rather than installing the latest release implicitly.
2. Record and verify package integrity information and document the expected npm scope, publisher, registry, and upstream source repository.
3. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
4. Review the package's lifecycle scripts, bundled files, transitive dependencies, and authentication behavior before recommending execution.
5. Install and run the CLI in a least-privileged, isolated environment with access limited to files intentionally submitted for processing.
6. Where operationally feasible, disable npm lifecycle scripts during installation and explicitly validate whether the reviewed CLI requires them.
7. Avoid elevated installation and execution. Ensure credentials and configuration files use restrictive filesystem permissions.
8. Establish a controlled dependency-update process that repeats security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broad enough to trigger on generic image/video requests, even when a user did not ask to use a terminal or external CLI. That can cause the agent to invoke this skill in contexts where users may not expect command execution, package installation, remote API usage, or credentialed actions, increasing the chance of unintended data exposure or tool misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to generate/edit images and videos through a hosted service but does not clearly warn that prompts, images, and possibly account metadata are sent to a remote third-party platform. In a creative tool context, users may provide sensitive photos, proprietary media, or confidential prompts, so omission of this disclosure can lead to unintentional exfiltration of sensitive content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.